Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

3b643ab2f9...56.exe

windows7-x64

7

3b643ab2f9...56.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 04:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3b643ab2f96615da4789f1997117edcd86203251134dd8aad7ea90b3a8323c56.exe

  • Size

    2.7MB

  • MD5

    0abef5fe35f2e93b59d532736a0e62f0

  • SHA1

    f91ec1ac0c869af35f77740806405ddf2dccec1f

  • SHA256

    3b643ab2f96615da4789f1997117edcd86203251134dd8aad7ea90b3a8323c56

  • SHA512

    32ac89f7faf640af2dab07fe667b0f6100d11b0ad96f1edc7cfccb0f97061b15d536fec97ce33ef09092291f4f3b591246d230089c4e97546fb5901a95230bc5

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB79w4Sx:+R0pI/IQlUoMPdmpSpj4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b643ab2f96615da4789f1997117edcd86203251134dd8aad7ea90b3a8323c56.exe
    "C:\Users\Admin\AppData\Local\Temp\3b643ab2f96615da4789f1997117edcd86203251134dd8aad7ea90b3a8323c56.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\SysDrvF5\devdobec.exe
      C:\SysDrvF5\devdobec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Galax82\bodasys.exe
    Filesize

    36KB

    MD5

    32fd27eaf88ae725a6e780660eb13a12

    SHA1

    d20092a4108ec3ce872e5a63b4f84024e0ac70e8

    SHA256

    8ff6fc7a88a6e5f06b9c55142eb6ca91842dc7447df243e9fe23bd9733d769d2

    SHA512

    c5b2e36a872165cb028456e6bf6b6854d63e703bbf413f8d04bbc15ed5b17a6f30cc32bab583e9adb7eb5b170f2097e0a31bc3b066b0f084fdcfeab1bbb4b8a0

    Download Submit

  • C:\Users\Admin\253086396416_6.1_Admin.ini
    Filesize

    205B

    MD5

    57a2da047206bc2ff4c9875284d80cb4

    SHA1

    f80cbe56f68b3a919129d9c7734f4bb7ba1bc884

    SHA256

    1da65da701af7d3005b607e46788535bce2ae6fb17a51e565b1ed3726c62ca5d

    SHA512

    bbd2223b3fc6e3c3d179fca3f22b5ae0616802dab2394ec58462dd8a16e6d310a4e90b22b88984e81d2d99d88b1ae08457e23aa2f1bcd71ef7b626f7eb28f3ed

    Download Submit

  • \SysDrvF5\devdobec.exe
    Filesize

    2.7MB

    MD5

    433f6106de2c7caabe151bbb358c928b

    SHA1

    68ddd0db67596bf860121af1dbb565dfb3c2089c

    SHA256

    c35756015a0621f82f64a7fde9ec91f08de1c446265a57edc55fbcf1e344e3fb

    SHA512

    217b21a51a9389ec64a7f06b61f1ba4b45e1c356741e565e1f1e1a929c55b7b0f53cf3308f8476587500e23ac6784a707d40e7fbc745d3f089d43d6573e47695

    Download Submit